Splunkd log defines a set of string values for log level, which should be used here. It seems java's built in level names will be used instead. Refer to splunk modular input documentation or ERD, and GetLevelString function in C# SDK.